Virtual instance architecture for mobile device management systems

ABSTRACT

System and method for remotely managing mobile devices. A virtual instance mobile device is maintained for each physical mobile device to be managed. Each virtual instance mobile device is executable in a computer runtime environment and includes a hardware emulation component configured to emulate the hardware components of the corresponding physical mobile device and a software emulation component corresponding to the software components of the physical mobile device, which is executable within the context of the hardware emulation component. Synchronization between the virtual instance mobile devices and their corresponding physical mobile devices is maintained, and data obtained from the physical mobile devices is stored. The physical mobile devices are remotely managed by utilizing their corresponding virtual instance mobile devices respectively.

CROSS REFERENCE TO RELATED APPLICATIONS

This patent application claims priority under 35 U.S.C. 119(e) to U.S.Provisional Patent Application No. 60/952,629, filed on Jul. 30, 2007,entitled “VIRTUAL INSTANCE ARCHITECTURE FOR MOBILE DEVICE MANAGEMENTSYSTEMS” and U.S. Provisional Patent Application No. 61/022,869, filedon Jan. 23, 2008, entitled “VIRTUAL INSTANCE ARCHITECTURE FOR MOBILEDEVICE MANAGEMENT SYSTEMS”.

TECHNICAL FIELD

This disclosure relates generally to mobile devices and managementsystems.

BACKGROUND

In a manner similar to personal computers and laptops, businessenterprises increasingly rely on mobile and handheld devices. Indeed,the capabilities and uses of mobile devices have moved beyond voicecommunications and personal information management applications to avariety of communications- and business-related functions includingemail, browsing, instant messaging, enterprise applications, and videoapplications. For example, the functionality of many mobile devices havebeen extended to include cellular and wireless local area network (WLAN)communications interfaces, as well as virtual private network (VPN) andother client applications. Furthermore, mobile devices used inenterprises may also include enterprise applications used by workers inthe field or otherwise.

Deployment, management and configuration of mobile and handheld devicesin enterprise environments, however, present certain challenges. Forexample, the vast and constantly changing variety of mobile devicetypes, functions and capabilities presents challenges to configuration,provisioning and troubleshooting. Moreover, the increasing capabilitiesand integration of mobile devices present challenges to networksecurity.

Various management systems have been developed to remotely manage mobiledevices in an enterprise environment, including, for example, dataprotection and synchronization, device security, application deployment,etc. A few such management systems employ the concept of a virtualdevice or virtual device domain, where a device management systemmaintains data associated with one or more mobile devices and allowsusers to change the data for the mobile device. The device managementsystem synchronizes the data maintained for the mobile device and thedata stored on the mobile device itself to help remotely manage themobile devices. The virtual mobile devices maintained by such devicemanagement systems, however, are merely snapshot images of theircorresponding physical mobile devices, representing the states ofcorresponding physical mobile devices at a particular instant. Thesevirtual mobile devices are not executable entities that emulate theoperations and/or functionalities of the physical mobile device.

SUMMARY

The invention relates to remotely managing physical mobile devices in anenterprise environment by utilizing the concept of virtual mobiledevices, where each virtual mobile device corresponds to a physicalmobile device being managed. In one embodiment, a mobile devicemanagement system is provided. The system comprises at least one virtualmobile device corresponding to at least one physical mobile device,wherein each virtual mobile device corresponds to a unique physicalmobile device and is executable in a virtual computer runtimeenvironment; a synchronization component configured to synchronize theat least one virtual mobile device with the corresponding at least onephysical mobile device respectively; a data store configured to storedata obtained from the at least one physical mobile device; and amanagement component configured to remotely manage the at least onephysical mobile device by utilizing the corresponding at least onevirtual mobile device respectively.

In another embodiment, an apparatus for remotely managing a mobiledevice is provided. The apparatus comprises a processor; a memory; atleast one network interface; a device emulation component for the mobiledevice, which comprises a hardware emulation component configured toemulate hardware components of the mobile device; and a softwareemulation component corresponding to software components of the mobiledevice and executable within the context of the hardware emulationcomponent; and a device management component configured to remotelymanage the mobile device, comprising computer-readable medium having aplurality of computer program instructions stored therein, which areoperable to cause the processor to maintain and execute the deviceemulation component in a computer runtime environment, synchronize thedevice emulation component with the corresponding mobile device, storedata obtained from the mobile device in the memory, and remotely managethe mobile device by emulating the mobile device in the computer runtimeenvironment using the device emulation component.

Both the hardware and the software emulation components in a virtualmobile device are executable in a computer runtime environment. Whenremotely managing a physical mobile device, its corresponding virtualmobile device's hardware and/or software emulation components areexecuted to replicate the behavior, functionalities, and characteristicsof the same software being executed on the actual hardware of thephysical mobile device.

Other aspects and advantages of the invention will become apparent fromthe following detailed description taken in conjunction with theaccompanying drawings.

DESCRIPTION OF THE DRAWINGS

FIGS. 1A to 1D are schematic diagrams illustrating an example mobiledevice management architecture according to one implementation of theinvention.

FIG. 2 provides a schematic, functional representation of how a controlclient may be integrated into a mobile device.

FIG. 3 is a schematic diagram illustrating an example server systemarchitecture.

FIG. 4 is a schematic diagram illustrating an example mobile devicesystem architecture.

FIG. 5 is a schematic diagram illustrating example application proxyfunctions.

FIG. 6 is a diagram illustrating example device virtualization layers.

FIG. 7 is a diagram illustrating mobile device virtualizationfunctionality.

FIG. 8 is a diagram illustrating alternative mobile devicevirtualization functionality.

FIG. 9 provides an example mobile device software architecture.

FIG. 10 is a schematic diagram illustrating mobile device supportfunctions.

FIG. 11 is a schematic diagram illustrating patch management functions.

FIG. 12 provides a user portal interface.

FIG. 13 is a schematic diagram illustrating document collaborationfunctions.

DESCRIPTION OF EXAMPLE EMBODIMENTS

A. Overview

The present invention provides methods, apparatuses and systems directedto facilitating deployment, configuration, and/or management of mobiledevices. In one implementation, for each of one or more mobile devices,a mobile device management application, maintains a virtual instance ofa given mobile device, and interacts with a control client applicationhosted on the physical instance of the mobile device to synchronize thestate of the physical instance of the mobile device with the virtualinstance of that mobile device. In a particular implementation, thecontrol client logs man-machine interface (MMI) data, file systemcommands, and other data characterizing usage of, and/or the actionsperformed on, the mobile device. Some or all of the log data is providedto the remote device management application hosted on a devicemanagement server, which can synchronize the state of the virtualinstance of the mobile device. In this manner, the device managementapplication provides an administrator a snapshot of the state of themobile device, and facilitates device management operations, asdescribed below.

In a particular implementation, a virtual instance of a mobile device isa running instantiation of the mobile device that can execute or operatein a virtualized execution environment. For example, a server may host avirtual machine that emulates the hardware (such as the microprocessoror controller) of the mobile device, allowing a copy of the mobiledevice operating system to be run. Additionally, one or moreapplications installed on the actual mobile device can also run on topof the mobile device operating system. The virtual instance of themobile device may also include all or a subset of the file system imageof the mobile device, as well as device configuration and settings. Inone implementation, the logged usage data transmitted from the controlclient application can be used to replay, using the virtual instance ofthe mobile device, the actions taken by a user on a mobile device for adesired period of time. Still further, a device management server 104,in some implementations, may support an interface that presents arendered image of the mobile device and activatable man-machineinterface that allows a user to input commands to, and otherwiseinteract with, the virtual instance of the mobile device.

In one implementation, there is a one-to-one correspondence between avirtual instance and a physical instance of a mobile device. The virtualinstance of the mobile device includes a hardware emulation layer and asoftware emulation layer. The hardware and software emulation layersemulate the hardware and software components of the physical instance ofthe mobile device respectively. Both the hardware and software emulationlayers are executable in a computer runtime environment, and generally,the software emulation layer is executable within the context of thehardware emulation layer to replicate the behavior, operations, and/orcharacteristics of the same software being executed on the actualphysical mobile device. The mobile device management applicationexecutes the hardware and/or software emulation layers of a virtualinstance of a mobile device in connection with remote management of thephysical instance of the mobile device.

B. Operation and System Architecture

FIGS. 1A and 1B are schematic diagrams illustrating the interactionbetween a physical instance of a mobile device 102 a and a devicemanagement server 104 operative to maintain a virtual instance of themobile device 102 b. As FIG. 1A illustrates, a physical instance of amobile device 102 a may communicate with device management server 104over a variety of communication channels and networks, such asWLAN/WiFi, BlueTooth, Wide Area Networks (WANs), and/or indirectly via apersonal computer 105 during synchronization. As FIG. 1B illustrates,device management server 104 may be operably connected to an enterprisenetwork 115. Enterprise network 115 may further include one or more ofemail or exchange servers 122, enterprise application servers 124,authentication (AAA) servers 126, directory servers 128, Virtual PrivateNetwork gateways, firewalls, and the like. Mobile devices 102 a mayaccess or utilize one or more of the enterprise systems or functionalitydescribed above.

FIGS. 1C and 1D illustrate other example deployment architectures.Device management server 104 can be installed in many locations likeinside the data center, a de-militarized zone (DMZ), topologicallyin-front of enterprise application servers and in the cloud depending onthe requirements of the network administrator. FIG. 1C illustratesdeployment of device management server 104 in the DMZ. As seen in FIG.1C above, device management server 104 may reside in the enterprise DMZand act as a proxy device for all data traffic coming from the physicalinstances 102 a of the mobile devices connecting through externalnetworks, such as GPRS/EDGE networks, or wireless networks (e.g., WiFi).All the data traffic that comes from the mobile phones will first cometo device management server 104 and from there the traffic will go totheir final destinations. To direct all traffic from the mobile devicesto device management server 104, an IPSEC tunnel may be used where theIPSEC tunnel is terminated at device management server 104. There can beat least two modes of operation here—split-tunneling and full tunneling.In split tunneling mode, all traffic that is destined to the enterprisenetwork will come through the IPSEC tunnel and any other traffic that isdestined to the internet will go directly to the internet through theoperator's network. In full tunneling mode, all traffic irrespective ofinternet traffic or enterprise network traffic will first come to devicemanagement server 104 before going out. In the full tunneling mode,device management server 104 can offer more comprehensive security andcontrols to the administrators as all traffic passes through the devicemanagement server 104, giving administrators full control of the trafficgoing in and out of the physical instance 102 a of a mobile device.

FIG. 1D illustrates a Software as a Service (SaaS) deploymentarchitecture. In this model, a device management server 104 b resides ina remote network relative to the enterprise, and can be remotely managedby enterprise administrators. This sort of model is well-suited forcompanies that have more SaaS-based applications where the data trafficusually does not come to the enterprise network. Clients are directlyserved from the servers sitting in the internet In this case, adeployment architecture where network traffic first comes to theenterprise network over IPSec Tunnels, and then goes to the internet tohost applications may be inefficient because it adds another hop to thenetwork. Also this model is mostly suitable for enterprises that havelesser number of devices and cannot afford to manage them exclusively inthe enterprise network. In an example SaaS model, the solution can beimplemented as a single box and that means the administrators will loginto the portal that is available to them to manage their devices or itcan be deployed in junction with another device management server 104 ain the enterprise network. In the two-box solution, the enterprisedevice management server 104 a protects the traffic entering theenterprise, while the device management server 104 b in the internetprotects the traffic directly going to Internet from the mobile client.In this scenario, two IPSec tunnels are deployed for a given mobiledevice 102 a to protect the traffic between the mobile client and theinternet and enterprise networks. Any traffic that is destined to theenterprise will use the enterprise IPSEC tunnel and all other trafficwill use the other IPSEC tunnel. In this case both the device managementservers 104 a, 104 b can communicate with each other to accomplishvarious functions. If for some reason the device management server 104 bin the hosted cloud sees some abnormal behavior (virus or somethingsimilar) it can immediately inform the device management server 104 a inthe enterprise to implement a policy to block the traffic coming fromthat particular mobile client.

B.1. Device Management Server

Device management server 104 may include, or operate in connection with,one or more of a data manager 140, a synchronization proxy 142, anapplication/image certification module 144, a profile control module146, a log module 148, a rules engine 150, a policy module 152 and anidentity manager 154. Device management server 104 may also operate inconnection with one or more virtual instances of respective mobiledevices. In one implementation, device management server 104 comprisesone or more virtual machines 106, as required to emulate the hardware ofdifferent mobile device types. Each virtual instance 102 b of a mobiledevice is a virtualized instance that is configured based on theconfiguration details and other attributes of the physical instance 102a of that mobile device. For example, the operating system that runs onthe virtual machine 106 is selected to be the same version as thatinstalled on the physical instance 102 a of the mobile device. Inaddition, device management server 104 may maintain a virtual image of adata storage device(s) installed on the physical instance of the mobiledevice.

A virtual instance of a mobile device may comprise information relatingto 1) one or more applications installed on the mobile device, 2) anoperating system, 3) a microprocessor, controller, and/or other hardwarefunctionality of the mobile device, and 4) an image of a storage deviceinstalled in the mobile device (such as a disk or flash/ROM image)including executable and non-executable files and data stored on astorage device of the mobile device. A storage device or file systemimage may comprise a computer file containing the complete contents andstructure of a data storage medium or device, such as a hard drive,flash drive, etc. An image contains all the information necessary toreplicate the structure and contents layout, as well as the actualcontents, of a storage device. Device management server 104 may maintainthis image information in a data store and load the virtual instanceinto the virtual execution environment as needed or in response to acommand from an administrator.

The virtual instance of the mobile device is a running instance of themobile device that executes in a virtual machine runtime environment.For example, the virtual machine runtime environment may emulate thehardware processor installed in the mobile device relative to theoperating system. In a particular implementation, the virtual machinefully simulates the complete hardware of the mobile device, allowing anunmodified operating system to run in connection with the virtualmachine. In other implementations, the virtual machine requires somemodification to the operating system. The virtual machine 106 can beimplemented using a Type 1 or Type 2 hypervisor. A Type 1 hypervisorruns directly on the hardware; a Type 2 hypervisor runs on anotheroperating system, such as Linux. Each virtual machine can run anyoperating system supported by the underlying hardware. Device managementserver 104 can thus run two or more different “guest” virtual instancesof respective mobile devices simultaneously, in separate “private”virtual computers. In some implementations, device management server 104may operate in connection with multiple virtual machine types, asrequired for management of different mobile device platforms.

Device management server 104 may also include one or more networkinterfaces 110 for communication with remote hosts, such as the physicalinstances of mobile devices, as well as enterprise applications and thelike. In some implementations, the virtual instances 102 b of the mobiledevices may communicate with remote hosts through the one or morenetwork interfaces 110. Device management server 104 may further supporta quarantine section 108, which is a conceptual area into which virtualinstances of mobile devices may be placed. In some implementations,physical instances of mobile devices that have become infected with avirus may have their corresponding virtual instances placed inquarantine section 108. In addition, new virtual instances that have notbeen fully defined relative to the corresponding physical mobile deviceinstance may also be placed in the quarantine section 108 until the fullvirtual instance has been defined. Placement of a virtual instance 102 bof a mobile device in quarantine section 108 can effect policy orconfiguration changes on an enterprises network. For example, access tothe enterprise network allowed to a physical instance 102 a of a mobiledevice, while the virtual instance 102 b is in quarantine section 108may be restricted to data connections to device management server 104 inorder to receive required configuration updates or patches, or to allowdevice management server 104 to discover one or more attributes of thephysical instance in order to fully define the virtual instance.

B.2. Mobile Device Control Client & Other Functionality

A control client application 302 hosted on the physical mobile devicemay monitor operation of the mobile device and interact with the remotemanagement application server 104 to allow the mobile device managementapplication server 104 to synchronize the state of the physical andvirtual instance of the mobile device. For example, the control clientapplication 302 may include layers or hooks inserted into one or morecommunications or device protocol stacks to monitor and/or log dataentered into or transmitted from the mobile device. For example, thecontrol client application 302 may log the key strokes entered using adial pad, keyboard, and/or pointing device. The control clientapplication 302 may also monitor and log file system operations. Inaddition, the control client application 302 may monitor and log datatransmitted to or from a communications interface, such as a cellularnetwork interface, a wireless local area network interface, and thelike.

FIG. 2 illustrates how control client functionality may be integratedwith a physical instance of a mobile device. In one implementation, thecontrol client functionality may comprise a control client application302 and one or more control points inserted to monitor data traversingthe interfaces of the physical instance of the mobile device. Forexample, a man-machine interface (MMI) control point 306 can be insertedinto the driver stack of the man-machine interface 308 to log keystrokedata. An application/file system control point 310 can be inserted tomonitor and log application level and file system commands. Stackcontrol point 314 may be inserted in one or more network protocol stacksof the physical instance of the mobile device, while port control point318 may be inserted at a different layer of the network protocol stack.One or more of the control points may be implemented as drivers that areinstalled in the appropriate driver stacks of the mobile device. In someimplementations, the control points may emulate the operation of higherlayer and/or lower layer drivers and pass data on to the lower or higherlayer native drivers. In some implementations, a rule set may definewhat data is captured.

Control client application 302 may store the data collected by thecontrol points in one or more log files stored on a storage device ofthe mobile device. For example, control client application 302 may storefile system commands (such as open, save, delete, copy, rename, etc.) infile system log 344. Control client application 302 may store keystrokedata in behavior log 352. Control client application 302 may store datarelating to its own operation in control log 340.

The control client application 302 can provide some of all of the datato the remote management application server 104, which may synchronizethe state of the virtual instance of the mobile device with the physicalinstance based on the data provided to it. In this manner, a centralmanagement server can, for example, maintain an accurate image of thedata storage device(s) of the mobile device, including the applicationsinstalled and the files stored on the mobile device. The control clientapplication 302 can operate to provide this data in real-time,intermittently during periods of non-activity (such as when the mobiledevice is inserted into a charging cradle), or at periodic intervals.Still further, the data may be provided to the remote managementapplication server 104 during a synchronization operation between themobile device and the user's personal computer. In a particularimplementation, the synchronization utility hosted by the personalcomputer may be configured to transmit the data to the remote managementserver 104. In addition, the control client application 302 may operatein one to a plurality of modes based on a set of rules or policies.Still further, the control client application 302 may also apply a ruleset that determines what data is provided to the central managementserver, and/or when such data is transmitted.

In one implementation, the control client application 302 and the remotemanagement server 104 may establish encrypted connections. For example,Virtual Private Network (VPN) tunneling and encryption may be used tosecure the connection. In a particular implementation, the physicalinstance of the mobile device may include port-based VPN functionalityto encrypt the connection between the control client application 302 andthe remote management server.

In some implementations, the physical instances of the mobile devicesmay include device management and/or data synchronization functionality.For example, the physical instances of the mobile devices may supportthe Open Mobile Alliance (OMA) Device Management (DM) protocol, and/orthe OMA Data Synchronization (DS) protocol. OMA DM is a protocolspecified by Open Mobile Alliance (OMA) for Device Management (DM)purposes, by the Device Management Working Group and the DataSynchronization (DS) Working Group. The current specification is OMA DMis version 1.2, which is incorporated by reference herein. OMA DMspecification is designed for management of small mobile devices such asmobile phones, PDAs and palm top computers. The device management maysupport 1) provisioning (configuration of the device (including firsttime use), enabling and disabling features), 2) configuration (allowingchanges to settings and parameters of the device), and 3) softwareupgrades (providing for new software and/or bug fixes to be loaded onthe device, including applications and system software), and 4) faultmanagement (such as reporting errors from the device, querying aboutstatus of device). The device management takes place by communicationbetween a server (which is managing the device) and the client (thedevice being managed). OMA DM is designed to support and utilize anynumber of data transports such as a) physically over both wireline(e.g., USB, RS-232) and wireless media (e.g., GSM, CDMA, Infrared,BlueTooth), and b) transport layers implemented over any of WSP (WAP),HTTP or OBEX or similar transports. The communication protocol is arequest-response protocol. Authentication and challenge ofauthentication may be incorporated to ensure the server and client arecommunicating after proper validation. The communication can beinitiated by the OMA DM server, asynchronously, using any of the methodsavailable such as a WAP Push or SMS. Once the communication isestablished between the server and client, a sequence of messages mightbe exchanged to complete a given device management task. OMA DM doesprovide for alerts, which are messages that can occur out of sequence,and can be initiated by either server or client. Such alerts are used tohandle errors, abnormal terminations etc.

Several parameters relating to the communication such as the maximummessage size can be negotiated between the server and client during theinitiation of a session. In order to transfer large objects, theprotocol does allow for sending them in smaller chunks. Error recoverybased on timeouts are not specified completely, hence, differentimplementations could possibly differ as the protocol is not fullyspecified in these areas. The protocol specifies exchange of packagesduring a session, each package consisting of several messages and eachmessage in turn consisting of one or more commands. The server initiatesthe commands and the client is expected to execute the commands andreturn the result via a reply message. Particular implementations of theinvention may also use the OMA Data Synchronization (DS) protocols andfunctionality for synchronization of files and data between the physicaland virtual instances of a given mobile device.

Using OMA DM or another suitable protocol, the control clientfunctionality discussed above can be installed on a physical instance ofa mobile device. For example, a mobile device without the control clientfunctionality can be provisioned and configured as follows. In apreliminary step, an administrator may create a virtual instance of amobile device with a minimal configuration. This virtual instance, priorto full configuration, may be quarantined—a state where the physicalinstance of the mobile device is not allowed access to the enterprise'sinternal network except for device registration and provisioning withthe device management server. Suitable identifying information mayinclude a device identifier, a user name, and the like. A user of themobile device may then be directed to connect to the device managementserver 104 using, for example, a dial up connection, or a dataconnection with a WAP browser. The device management server 104, actingas an OMA DM server, may then interrogate the mobile device to learn oneor more attributes (such as model number, serial number, operatingsystem type and version, etc.), and provision and configure the mobiledevice. When the physical instance of the mobile device has beenconfigured, the device management server 104 may further use theconfiguration and other information related to the mobile device tocomplete the virtual instance of the mobile device and remove it fromquarantine.

The device management server 104 may also include other functionality,such as image and/or application software installation, upgrade and/orrepair for one or more mobile devices. In one implementation, anadministrator may select one or more virtual instances of respectivemobile devices, and cause device management server 104 to transmitupdated software applications, patches, and the like to the physicalinstances of the mobile devices. During installation of the software,the control client application may communicate the log data reflectingthe changes to device management server 104, which results in changes tothe virtual instance of the mobile device. In another implementation,the administrator may change one or more attributes of the virtualinstance of the mobile device, which causes the device management server104 to transmit commands to the physical instance of the mobile deviceto cause it to implement the changes made to the virtual instance of themobile device.

The physical and virtual instances of the mobile device, through thecontrol client, device management server, and the protocols describedherein, can effect state changes, policy and other device managementrules, and affect one or more behaviors in one or both directions. Inone implementation, state changes or behaviors on the physical instancecan cause corresponding state changes or behaviors to the virtualinstance of the mobile device. In some modes, state changes resultingfrom execution, modification, re-configuration, etc. of the virtualinstance may result in state changes to, or behaviors of, the physicalinstance of the mobile device. For example, an administrator may run thevirtual instance of the mobile device (for example, to fix a problem theuser is experiencing during a help-desk call) and trigger the devicemanagement server 104 to synchronize the resulting state and behavior ofthe virtual instance with the physical instance of the mobile device.For example, a mobile device user may watch the display screen of thephysical instance of the mobile device, as a help desk operator controlsthe virtual instance of the mobile device to accomplish an action, suchas retrieving a desired document, configuring an email client, and thelike. The state and behavior information may be transmitted to thecontrol client 302 which may implement the resulting changes.Furthermore, synchronization of state and behavior may operate inreal-time. In other implementations, an administrator may change one ormore policies by modifying the virtual instance of the mobile device andcause device management server 104 to synchronize the policy change withthe physical instance of the mobile device at a later time.

In some implementations, the device management server 104 may beoperative to proxy transactions, sessions and/or connections between thephysical instance of the mobile device and other logical or physicalnodes, such as enterprise application services, and the like. Forexample, in one implementation, the virtual instance of the mobiledevice may be used as a proxy, which accesses enterprise application124. The resulting changes to device state, file system state and datathat can be used to simulate user-observed behaviors on the displayscreen of the physical device instance can be communicated back to thephysical instance of the mobile device and rendered on the display andotherwise effected by the control client 302. In other implementations,the device management server 104 may simply proxy the connection, andselectively transmit data messages from the enterprise applicationserver (for example) to both the physical and virtual instances of themobile device.

B.3. Device Management Server—Virtual Instance System Architecture

Today mobile device management is difficult and challenging because thedevices cannot be reached easily because of the networks they operateon. Embodiments of the present invention facilitate or provide anarchitecture that eases the device management, security andcollaboration issues through an innovate architecture usingvirtualization. In a particular implementation, a virtual instance ofmobile device running in a network performs resource intensive process,and passes the results of that processing (e.g., through synchronizationand other data transfers) to the physical instance of the mobile device.In this manner, the user experience may be improved on the mobiledevice.

FIG. 6 illustrates an example mobile device virtualization architectureaccording to one possible implementation of the invention. Thevirtualization architecture comprises four functional layers. Dependingon the functionality or the task to be performed, one or more of thefunction layers may be used to perform a given operation or task. Thefour layers are session layer, control layer, virtual data layer and thevirtual machine/instance layer.

Data Session Layer 610

Data session layer 610 is responsible for handling data session relatedfunctions. This layer acts as a proxy for all the session traffic goingbetween the mobile devices and the application servers. Services likeIPSEC VPN, SSL-VPN, Firewall or Network based Anti-virus functions arehosted in this layer. Data session layer 610 can maintain a sessiontable for all the traffic to steer the traffic appropriately.

Control Layer 620

Control layer 620 is the main layer where most control functions arehosted. Policy settings, device management, data synchronization, andanti-virus engine run in the control layer. For example, control of thedata is implemented in this layer.

Virtual Data Layer 630

Virtual data layer 630 is where the copies of the mobile device data aremaintained. Data synchronization service in the control layer willsynchronize the data between the mobile device and the virtual datalayer copy of the mobile device data. OMA DS standard can be used forthe synchronization services. Anti-virus running in the control layercan work on this virtual data to provide the anti-virus functionality tothe end device. If the anti-virus service finds any abnormality then thedevice will be put into quarantine mode until the virus has been cleanedon the actual device.

Virtual Machine (VM) Layer 640

VM layer 640 is the layer where the virtual instances of the clientdevices reside. The virtual instances 102 b are executing replicas ofthe actual mobile devices 102 a exhibiting substantially the samebehavior and functionality. These virtual instances need not run all thetime and can be brought up and down depending on need. This VM layer 640may execute on top of virtual containers or virtual machine monitors,provided by companies like XenSource™ or VMware or KVM (Kernel VirtualMachine). As discussed below, the VM layer 640 can be configured in atleast two ways: full hardware and software emulation of the mobilephone, or software-only emulation.

B.3.a. Virtualization—Full Hardware & Software Emulation

Virtualization layer, in one implementation, includes functionality thatvirtualizes substantially the entire physical instance of a mobiledevice including the hardware and software. In this implementation, themobile device image can be extracted from the mobile device and run inthe virtual machine layer. In such an implementation, the virtualmachine layer includes hardware emulation functionality. For example,the mobile device processor instruction set could be x86, ARM or someother instruction set that supports or emulates the processor that themobile phone is running. FIG. 7 illustrates a virtualizationarchitecture according to one implementation of the invention. In aparticular implementation, the virtualization layer includes, for agiven mobile device, a hardware emulation layer 710 (including networkand storage device emulation), and software emulation layer 720(including operating system 731, 732, 733, virtual device drivers 741,742, and one or more applications 751, 752, 753). The bottom layer 760is the hardware layer of the host (in one implementation, devicemanagement server 104). In a particular implementation, a nativeoperating system, such as Linux, runs on top of the hardware layer. Inthe native operating system, virtual containers will be created for thevirtual mobile devices to run. In the virtualization system, thehardware emulation layer 710 includes communication layers for networkand storage (e.g., Flash memory) systems. Flash driver mux and networkdriver mux act as the gateway for all the network and memory relatedactivities associated with the virtual instances.

Hardware Emulation Layer 710

Hardware emulation, in one implementation, features bit to bit emulationof the real hardware for the mobile device image to run. In this modelthe software image is not modified or changed to run in the virtualinstance and that means whatever the hardware that the mobile phone hasfor which the image has been built is to be emulated exactly in thedevice management server 104. Hardware emulation functionality willtypically vary with the many different hardware models. Depending on themobile device, the corresponding hardware or processor chip is emulatedin the appliance. To reduce the work on the virtual instance, a subsetof the hardware can be virtualized, such as the processor, memory modeland other important peripherals like flash, bootrom, etc. In oneimplementation, the choices as to what aspects are virtualized areapplication-driven. In other words, since management of applications isimportant, any hardware that is required to support the applications canbe virtually emulated. For example, two aspects that almost allapplications require are network access and flash space to store thedata. Virtualizing other hardware components like WiFi, GPS, GSM,Camera, Speakerphone etc., in the virtual instance is optional and maydepend on the applications supported by device management server 104. Inaddition, a virtual instance of a mobile device may include all or asubset of the applications installed on a corresponding physicalinstance of the mobile device.

The hardware emulation layer 710 usually include various hardwareemulation components or modules, each of which corresponding to one ormore pieces of hardware of the physical instance of the mobile device towhich the virtual instance corresponds. For example, the hardwareemulation layer may include a processor emulator that emulates theprocessor of the corresponding physical instance of the mobile device, amemory emulator that emulates the memory storage or subsystem of thecorresponding physical instance of the mobile device, a networkinterface emulator that emulates the one or more network interfaces,e.g., WiFi, Bluetooth, etc., of the corresponding physical instance ofthe mobile device, an input/output (I/O) emulator that emulates the oneor more I/O devices, e.g., keypads, wheels, sliders, buttons, etc., ofthe corresponding physical instance of the mobile device, a displayemulator that emulates the display screen on the corresponding physicalinstance of the mobile device, etc. Each emulator imitates or duplicatesthe behavior of the piece of hardware it emulates. It generallymaintains the look, feel, operations, characteristics, behavior, etc. ofthe original pieces of hardware.

There are a variety of different ways to implement the individualemulators or modules included in the hardware emulation layer. Accordingto one implementation, the emulators or modules are implemented ascomputer-executable programs, represented by computer programinstructions stored in various forms of computer-readable media. Forexample, one way to emulate the processor of a physical instance of amobile device is to use an interpreter, which follows the execution flowof the program code and, for every machine code instruction encountered,executes operations on the processor(s) of the device management systemthat are semantically equivalent to the original instruction. Somepre-packaged CPU simulators may also be incorporated into the processemulator. A way to emulate the memory storage of a physical instance ofa mobile device is to use an array of elements, each corresponding to amemory location within the memory storage on the physical instance ofthe mobile device. The hardware emulation programs may be loaded into acomputer runtime environment for execution in order to emulate theoperations and/or behaviors of the hardware components of thecorresponding physical instance of the mobile device for which theseprograms emulate.

According to one implementation, the hardware emulation layer 710 is apart of a virtual mobile device platform. The device management servercauses the hardware emulation layer of a virtual instance of aparticular mobile device to be executed when there is a need to emulateone or more pieces of hardware of the corresponding physical instance ofthat mobile device. For example, when the device management server 104emulates the software operations of the physical instance of aparticular mobile device, it first loads the hardware emulation layer ofthe virtual instance of that mobile device and then executes a copy ofthe software of the physical instance of the mobile device within thecontext of the hardware emulation layer.

Software Emulation Layer 720

To emulate the software components of a physical instance of a mobiledevice, according to one implementation, the corresponding virtualinstance of the mobile device includes a software emulation layer, whichincludes a copy of the operating system, one or more device drivers,and/or one or more applications on the physical instance of the mobiledevice. For example, application software on a mobile device may includeemail, messaging, calendar, task list, address book, device settings,etc.

The software may be executed within the context of the hardwareemulation layer of the virtual instance of the mobile device asdescribed above to replicate the behavior, operations, and/orcharacteristics of the same software being executed on the correspondingphysical instance of the mobile device. For example, to emulates aspecific piece of application software, the device manage server 104first causes the hardware emulation layer to be loaded and executed, andthen causes the copy of the piece of application software from thesoftware emulation layer 720 to be executed on top of the hardwareemulation layer 710, i.e., interacting with the hardware emulation layer710, thus imitating the piece of software being executed on the physicalinstance of the mobile device and interacting with the actual hardwarecomponents.

Flash and Network Driver 741, 742

In a physical instance of a mobile device, communications occur throughthe GPRS stack or WiFi stack. Device management server 104 hosts virtualhardware for storage and network hardware components. Custom drivers maybe built for this virtual hardware which resides in the devicemanagement server 104. In one implementation, the drivers for thesevirtual hardware devices are installed on the physical instance of themobile device as well so that the virtual drivers become part of thesoftware image on the mobile device. These two drivers have no functionin the actual mobile phone as there is no hardware corresponding tothose drivers and hence they will not be loaded. When the software imageis extracted and run in the virtual instance, however, all other driverswill fail (not be loaded) except the virtual drivers because there is noreal hardware emulation for devices like GPS, WiFi, GSM, Speakerphone,etc. Virtual drivers will find the virtual hardware, like network andflash, so they will attach themselves to this virtual hardware. Thenetwork driver provides the glue to the communication between thevirtual instance and the device management server 104 and similarly avirtual Flash driver will provide the glue for virtual instance flashlayer and the data storage attached to or available to device managementserver 104.

Communication

The communication between the virtual instance and the device managementserver 104 happens through the two main drivers, virtual network driverand the flash driver. Virtual network driver of each virtual mobiledevice communicates with the virtualization layer network driver(Network Driver Mux) of device management server 104 through the networkhardware emulation functionality. The network driver of thevirtualization layer of device management server 104 acts as amultiplexer in the sense it will communicate with all the virtualinstances and the actual network interface(s) in the device managementserver 104. There can be two types of communication that can happenbetween a virtual instance and the outside. One is the virtual instancetalking to the device management server 104 and other is that thevirtual instance talking to remote devices and hosts. Since the devicemanagement server 104 has full control of the virtual instances and thevirtual instances communicate through the device management server 104,device management server 104 can act as a gateway for the virtualinstances. Device management server 104 may have a DHCP service runningwhere it can assign the IP addresses to the virtual instances as theybecome live and the device manager's IP address can be configured as thegateway IP address for the virtual instances. For all the communicationthat can happen between the virtual instance and the outside devices,device management server 104 can act as the NAT gateway so that there isno need to assign routable IP addresses to the virtual instances. Forany communication that originates from outside, first the userauthenticates with the device management server 104 and then indicatesto which virtual instance they want to connect. Based on the usercredentials, device management server 104 can grant access to thevirtual device.

B.3.b. Virtualization—Software Only

In another implementation, the virtual instance replicates theapplication environment of the physical mobile device, but does notreplicate the hardware functionality of the actual device. Devicemanagement server 104, in a particular implementation, maintains arepository of operating systems (like Windows Mobile 5.0, Windows Mobile6.0 or Symbian 7.1, and/or Linux versions) and a repository ofapplications (like salesforce.com, RSS reader etc.,) that can beinstalled on these operating systems. When a new mobile device isregistered with device management server 104, it can query all thedetails of the mobile device including the operating system,applications installed, memory profiles etc., either through OMA DM orvia an installed client on the mobile device. Device management server104 maintains this info in its database on what applications are runningon the device and on what operating systems. As applications areinstalled or removed, this information is updated through out the lifeof the mobile device to be able to create an accurate virtual instanceof a mobile device.

Applications

The device management server 104 monitors the physical mobile devices(either through the client installed on the actual mobile device orthrough OMA DM queries) for application installations or removals fromthe actual device so that the same behavior can be replicated in thevirtual instance. A new application can be installed on a mobile devicein multiple ways. One way is that the user installs the application orthe application has been installed through some automated way like OMADM functionality. Through software and patch management functionality,new software can be installed on the mobile devices without userintervention. In both cases (either the user initiated installation orautomated installation), the new application installation information ispushed to the device manager via a client installed on the mobiledevice. The newly installed application software is also maintained inthe application repository in the device manager so that the devicemanager can use it to create the virtual instance of the actual mobiledevice. This application software can be made available to the devicemanagement server 104 in multiple ways. One way is to provide the linkon where the software is available and another way is that theadministrator will download the application to the repository. Everytime there is a change in the software version or new software has beenadded, one of the above methods is used to acquire the software. Thedevice management server 104, in one implementation, acquiresapplication software prior to installing the software on the actualdevice so that the virtual device can be created with all theapplications in time. These applications may have been developed to runon the operating system directly or a common platform like J2ME etc., Ifthe applications run directly on the operating system then there will bedifferent versions of the software for different operating systems andif the applications are written for platforms like J2ME then the sameversion of the application can be run on all operating systems. Bothtypes of applications are supported in the device manager applicationrepository.

Operating System Versions

Device management server 104 maintains copies of all the operatingsystems used in the mobile devices under management so that the devicemanager can create virtual instances of the actual mobile devices. In aparticular implementation, the operating systems are compiled to acommon processor or hardware instruction set. The repository of theoperating systems can be collected, maintained and distributed by acentral service provider for all the companies (something similar to thedistribution of virus definitions). Whenever ISVs (Independent softwarevendors like Microsoft Corp or Symbian) release a version of anoperating system, the service provider can download the operating systemand keep it in its distribution server. All the device managementservers 104 can be equipped with software download managers configuredto talk to the software distribution server. Whenever there is newsoftware being added to the distribution servers, all registereddownload managers can be notified of the availability of the newsoftware. The download managers can be configured to download thesoftware automatically or with user consent.

Virtualization Layer

Virtualization Layer includes functionality operative to create andmaintain multiple virtual instances in the device management server 104.All the different operating systems that are compiled for the sameinstruction set as the device manager (for example x86) can be directlyrun on the host operating system (like Linux). For creating this type ofvirtualization an existing virtualization technology (like XenSource™ orVirtual Iron®) can be used. If the operating systems are compiled foranother instruction set like ARM (which is more popular in the mobiledevice world) then a JIT conversion mechanism (like QEMU, a deviceemulator layer where ARM instructions will be converted to x86instruction in run time) can used in between the guest operating systems(guest operating systems are those which run in the virtual instances)and the host operating system virtualization layer.

Further to the applications that are installed on the actual mobiledevice, one or more virtual drivers may be installed in the virtualinstance so that the virtual instance of the mobile can communicate withother devices. Examples of those virtual drivers are virtual networkdriver and virtual flash driver. Virtual network driver is installedalong with other applications in the virtual instance so that thevirtual instance can communicate with actual mobile device and otherhosts (such as enterprise applications and the like). In this approach,the virtual network driver can be assigned an IP address to communicatein and out of the virtual instance. This virtual network driver willprovide the communication layer for the TCP/IP stack in the operatingsystem. Other drivers installed on the virtual instance include theflash and memory driver. Any mobile device will have DRAM, ROM, Flashand/or external Flash. The boot-code typically is burnt on to ROM, whilethe operating system and applications are burnt onto Flash. Someapplications may reside on an external Flash disk. The virtual flashdriver, in one implementation, emulates Flash or other memory in theactual mobile device so that the applications can be installed the sameway they are installed in the actual mobile device.

Building and Invoking Virtual Instances

To build a virtual instance, device management server 104 queries theactual mobile device to get configuration information regarding theprocessor, memory, operating system and applications. This informationis used in modeling the virtual instance. After querying theinformation, device management server 104 will make sure it has enoughmemory to host the virtual instance, and that it has the operatingsystem and necessary applications in its repository. Additionally, thedata stored on the physical instance of the mobile device will be backedup from the actual mobile device for creating the virtual instance. Forexample, to create the similar environment with the applications as theactual mobile device, all the application data is maintained. If any ofthe information is missing or the device management server 104 does nothave necessary components to build the virtual instance, then it willabort creating of the virtual instance and report an error to theadministrator so that the administrator can take action. If all thecomponents are available, then device management server 104 creates thememory model similar to the actual device and then brings the operatingsystem up. A map of the actual mobile device's applications and thecorresponding data is maintained so that the right data can be copied tothe right location in the virtual instance so that the application willbehave the same way it behaves in the actual mobile device. After theguest operating system comes up all the applicable applications areinstalled on top of the guest operating system.

This installation can be done similar to the actual device where aprotocol similar to OMA DM is used. In this case the virtual instanceand the device management server 104 communicate through OMA DM protocolto install the applications. After the applications are installed theapplication data is copied to the right locations so that when theapplications are invoked in the virtual instance, they behave with thesame properties as they would in the actual mobile device. When theapplication installation is done, the entire model (or image) isrecorded and kept in the database including the operating system and itsregistry. This way next time the same virtual instance needs to bebrought up, it can be brought up with out going through the sameinstallation steps as the first time. In case of error, a provision maybe provided for the administrator so that he/she can build the virtualinstance by picking the operating system and the applications from therepository manually. To see the progress for administrators, a remotesession is established to the virtual instance so that administratorscan fix any problems that may arise during the installation process. Foraccomplishing this, all I/O traffic is captured and redirected to theadministrator's console. A small run time client is installed in thevirtual instance to capture the input and output and redirect it to theadministrator's console. Based on the captured output from the virtualinstance, a rendered image of the virtual device can be created in thedevice manager's management tool where the administrator can input thecommands and see the output. This way the administrator can fix anyissues that may arise during installation time.

In another implementation, a software client similar to the one thatruns on the actual mobile phone may run inside the guest operatingsystem to synchronize the data between the virtual instance and thedevice management server (the data that is synchronized with the actualdevice). In this model the applications (including executables) can becopied as well to run in the virtual instance of the mobile.

Communication Between Virtual Instance and Device Manager

Communication between the virtual instance and the device managerhappens through two main drivers, virtual network driver and the storage(flash) driver. Virtual network driver communicates with thevirtualization layer network driver. As above, the virtualizationlayer's network driver acts as a multiplexer in the sense it willcommunicate with all the virtual instances and the actual network driverin the device management server 104. There can be two types ofcommunication that can happen between a virtual instance and outside.One is the virtual instance communicating with the device managementserver 104 and other is the virtual instance communicating with remotehosts. Since the device management server 104 has control of the virtualinstances, device management server 104 can act as a communicationsgateway for the virtual instances. Device management server 104 may hosta DHCP service where it can assign IP addresses to the virtual instancesas they become live. In such an implementation, the device manager's IPaddress can be configured as the gateway IP address for the virtualinstances. For all communications that can happen between the virtualinstance and remote hosts, device management server 104 can act as theNAT gateway so that there is no need to assign routable IP addresses tothe virtual instances. For any communication that originates fromoutside, the user authenticates with the device management server 104and indicates to which virtual instance they want to connect. Based onthe user credentials, device management server 104 can grant access tothe virtual instance of the mobile device.

C. Uses of Virtual Instance of Mobile Device

Maintaining a virtual instance of a mobile device at a management serverfacilitates a variety of configuration, management, troubleshootingand/or security functions. For example, the virtual instance provides anadministrator a detailed snapshot of the state of the mobile device. Thevirtual instance also allows for the administrator to perform managementoperations, such as virus/malware scans, application/imagecertification, etc., on the virtual instance of the mobile device,without consuming computing resources of the physical instance of themobile device.

C.1. Offline Virus-Scanning

In a particular implementation, virus scanning or detection functionscan be executed on the virtual instance of the mobile device withoutconsuming the resources (e.g., battery, processor, memory, etc.) of thephysical instance of the mobile device. Given that the virtual instanceof the mobile device is hosted on a more capable processing platformwith more available resources (e.g., memory, processors, etc.), robustvirus scanning and detection functions can be applied. Furthermore,given that the virtual instance of the mobile device is executablewithin the virtual environment, the virus scanning or detectionfunctions can operate to invoke execution of one or more operationswithin the virtual execution environment to possibly detect polymorphicvirus code by essentially using the virtual instance of the mobiledevice as an emulator. Furthermore, if a virus or malware is detected,device management server 104 can operate to place the affected mobiledevice under quarantine, restricting access to the enterprise network.Moreover, the device management server 104 may remove the malware orvirus from the physical instance of the mobile device and/or install apatch to one or more applications hosted on the mobile device, as well.

C.2. Action Replay

The virtual instance of the mobile device and the logged usage dataprovided by the control client application 102 can also be used toreplay a sequence of user actions. This can be useful for diagnosticsand troubleshooting. For example, a help desk administrator could replaya last N set of operations to determine what actions a user has takenprior to a trouble report. This also may be useful to security as thelogged data can reveal what files or data were transferred from one ormore network interfaces of the mobile device.

C.3. Modifying Application Settings

A user reports that a particular application is not working in hismobile device environment, and logs a case with the administrator. Theadministrator logs into the device management server 104 and initiatesthe virtual instance of the user's mobile device. If the applicationdata associated with the virtual instance is not latest, theadministrator issues a synchronize command to synchronize theapplication data with the actual mobile device. Using the virtualinstance, the administrator opens up the application, fixes the problemand saves the application or other device configuration settings. Thesettings are saved in the virtual instance. The administrator issues asynch command and the modified application data gets pushed to theactual mobile device. The user opens up the application and sees theproblem is fixed. During this whole process the user is not locked upand he/she can work normally with the mobile device.

C.4. New Application Roll-Out

Before a new application is rolled-out, it can be checked on the virtualinstance first to make sure the application can fit into the memory ofthe physical mobile device and does not create undesirable behavior orinteroperability issues.

C.5. Problem Diagnosis, Device Maintenance and Helpdesk Support

A user reports a problem with an application installed on her mobiledevice. Before dispatching someone to look at the problem, theadministrator can log into the virtual instance of the mobile device,and figure out if the problem is a software issue or a hardware issue.This helps the user diagnose the problem quickly, thereby saving time infixing the issue.

Embodiments of the present invention can provide a solution to fixproblems on the mobile devices remotely. Currently, the mobile deviceneeds to be dedicated to an IT person to fix most problems. During thistime, the user cannot use the device. With the virtualizationarchitecture, the helpdesk functionality can be improved considerably.There could be two types of problems that a user may encounter—softwareproblems or hardware problems. There are two solutions that will addressthese problems. In both the cases the administrator can remotely loginand access the mobile device through the web portal provided by thedevice management server 104. Support functions can operate in anoffline or an online mode.

Device Offline Support

In the offline support model, when there is a problem the user will logthe problem with the IT department. The IT person will log into thedevice management server 104, bring up the virtual instance and identifythe problem. If the physical instance of the mobile device is notsynchronized with the virtual instance, then device management server104 may trigger a synchronization. In the offline model, the IT personmay attempt to fix a problem by access the virtual instance andmodifying its configuration (e.g., settings, application versions,drivers, patches, etc.). The modified configuration data will be pushedto the mobile device and the user sees the problem fixed. The blue solidline 1010 in FIG. 10 illustrates the communication path. During thewhole process the user does not need to dedicate the device for theadministrator to fix the problem.

Device Online Support

In the online support model, when there is a problem the user andadministrator will negotiate a time to fix the problem. The user willload a small application (if not already installed) which will capturethe I/O of the mobile device and redirect it to the device managementserver 104, which sends the data to the administrator's web console. Theweb console can provide a similar skin as real mobile device so that theadministrator can work on the device as if he is working on the actualdevice. During this time the mobile user cannot use the device and itwill be fully under the administrator's control. The red dash line 1020in FIG. 10 illustrates the communications path for the online supportmode.

C.6. Patch Management

FIG. 11 illustrates operation of patch management functionalityaccording to one possible implementation of the invention. Patches caninclude firmware upgrades and software updates. Before delivering thepatches to the actual devices, the patches can be tried and tested inthe virtual instance and then deploy them to the actual mobile device tominimize their impact on the actual device. For example, softwarepatches can be first tried and tested in the virtual instance beforedeploying the software patch on the actual device. Every time a patch isapplied, the current image (prior to the patch) can be backed up so thatin case if the patch creates problems, the backed up image can be usedto bring back the previous state.

C.7. User Portal

Users can access a web portal of device management server 104 and accessinformation regarding one or more mobile devices. In the mobile device,only one screen can be seen at a time where as in the portal all therelevant information can presented in one screen to the user. The usercan download or upload or share the data from the web portal. Apart fromaccessing the data, the user can also perform some functionality likelocking the device, locating the device (if GPS enabled) and wiping thedata in case of the device being lost. An example screen is shown inFIG. 12.

C.8. Document Collaboration: (File Sharing, Printing, Email)

FIG. 13 illustrates operation of document collaboration functionalitythat can be implemented in connection with device management server 104.Since the data associated with a mobile device is backed up andavailable in connection with the virtual instance 1300 hosted by thedevice management server 104, users when they want to share a document,can just send a command from the mobile device 102 a which will instructthe device management server 104 to do the necessary action. The usercan select the file and select share, print or email commands. With thisapproach the user does not need to send the document from the actualmobile device 102 a reducing bandwidth requirements and saving airaccess time. In another implementation, the users can map their networkfiles with device management server 104, which can show those file namesto the user on the mobile device. The user can then browse and select afile to download or share with other users without downloading theactual file to the mobile device, again achieving savings in terms ofbandwidth and air time consumption.

C.9. Application Proxy Mode

FIG. 5 shows an example deployment of device management server 104 in aproxy mode, where device management server 104 proxies sessions betweenmobile devices 102 a and one or more enterprise applications. Devicemanagement server 104, when acting as a proxy device, can proxy theapplications so any specific environments (like BlackBerry®) can begeneralized so that any device can be used for that specificenvironment. For example, device management server 104 can act as aBlackBerry® device to the BlackBerry® network service environment fornon-BlackBerry® mobile devices. Also the proxy service benefits theusers when they want to migrate to another environment different fromtheir current one. In the example illustrated in FIG. 5, devicemanagement server 104 is acting as a proxy for a BlackBerry® (or othermobile email) service. BlackBerry® service requires all mobile trafficto hit their Network Operations Center (NOC) first before entering theenterprise network. A typical BlackBerry® solution includes Blackberryenterprise servers, and a BlackBerry® gateway in the NOC. All thetraffic going in and out of mobile clients will first hit the mobilegateway in the BlackBerry® NOC before going anywhere else (includinginternet destinations). They provide the end to end security from mobileclient all the way through the enterprise email servers and that is howthey provide the confidentiality to the enterprise user traffic. Anytraffic destined to the internet will first go to the BlackBerry® NOCand then goes to the final destination from there. In the above figure,the red line indicates the traffic flow in a BlackBerry® environment,and the blue line indicates the normal traffic flow. To provide theBlackBerry® services to the normal users, one can deploy devicemanagement server 104 as an Application Proxy server. In this case, allthe BlackBerry user traffic will directly go between the BlackBerryenterprise server and the BlackBerry gateway in NOC. All the trafficfrom non-blackberry devices will go through the device management server104 device for Blackberry services.

D. Example Mobile Device and Server System Architectures

D.1. Example Server System Architecture

FIG. 3 illustrates an example computing system architecture, which maybe used to implement a physical server. In one embodiment, hardwaresystem 200 comprises a processor 202, a cache memory 204, and one ormore software applications and drivers directed to the functionsdescribed herein. Additionally, hardware system 200 includes a highperformance input/output (I/O) bus 206 and a standard I/O bus 208. Ahost bridge 210 couples processor 202 to high performance I/O bus 206,whereas I/O bus bridge 212 couples the two buses 206 and 208 to eachother. A system memory 214 and a network/communication interface 216couple to bus 206. Hardware system 200 may further include video memory(not shown) and a display device coupled to the video memory. Massstorage 218, and I/O ports 220 couple to bus 208. Hardware system 200may optionally include a keyboard and pointing device, and a displaydevice (not shown) coupled to bus 208. Collectively, these elements areintended to represent a broad category of computer hardware systems,including but not limited to general purpose computer systems based onthe x86-compatible processors manufactured by Intel Corporation of SantaClara, Calif., and the x86-compatible processors manufactured byAdvanced Micro Devices (AMD), Inc., of Sunnyvale, Calif., as well as anyother suitable processor.

The elements of hardware system 200 are described in greater detailbelow. In particular, network interface 216 provides communicationbetween hardware system 200 and any of a wide range of networks, such asan Ethernet (e.g., IEEE 802.3) network, etc. Mass storage 218 providespermanent storage for the data and programming instructions to performthe above described functions implemented in the location server 22,whereas system memory 214 (e.g., DRAM) provides temporary storage forthe data and programming instructions when executed by processor 202.I/O ports 220 are one or more serial and/or parallel communication portsthat provide communication between additional peripheral devices, whichmay be coupled to hardware system 200.

Hardware system 200 may include a variety of system architectures; andvarious components of hardware system 200 may be rearranged. Forexample, cache 204 may be on-chip with processor 202. Alternatively,cache 204 and processor 202 may be packed together as a “processormodule,” with processor 202 being referred to as the “processor core.”Furthermore, certain embodiments of the present invention may notrequire nor include all of the above components. For example, theperipheral devices shown coupled to standard I/O bus 208 may couple tohigh performance I/O bus 206. In addition, in some embodiments only asingle bus may exist, with the components of hardware system 200 beingcoupled to the single bus. Furthermore, hardware system 200 may includeadditional components, such as additional processors, storage devices,or memories.

As discussed below, in one implementation, the operations of one or moreof the physical servers described herein are implemented as a series ofsoftware routines run by hardware system 200. These software routinescomprise a plurality or series of instructions to be executed by aprocessor in a hardware system, such as processor 202. Initially, theseries of instructions may be stored on a storage device, such as massstorage 218. However, the series of instructions can be stored on anysuitable storage medium, such as a diskette, CD-ROM, ROM, EEPROM, etc.Furthermore, the series of instructions need not be stored locally, andcould be received from a remote storage device, such as a server on anetwork, via network/communication interface 216. The instructions arecopied from the storage device, such as mass storage 218, into memory214 and then accessed and executed by processor 202.

An operating system manages and controls the operation of hardwaresystem 200, including the input and output of data to and from softwareapplications (not shown). The operating system provides an interfacebetween the software applications being executed on the system and thehardware components of the system. According to one embodiment of thepresent invention, the operating system is the Windows® 95/98/NT/XPoperating system, available from Microsoft Corporation of Redmond, Wash.However, the present invention may be used with other suitable operatingsystems, such as the Apple Macintosh Operating System, available fromApple Computer Inc. of Cupertino, Calif., UNIX operating systems, LINUXoperating systems, and the like. Of course, other implementations arepossible. For example, the server functionalities described herein maybe implemented by a plurality of server blades communicating over abackplane.

D.2. Example Mobile Device Hardware Architecture

FIG. 4 shows a schematic representation of the main components of themobile device 102 a, according to one implementation of the invention,which is adapted for use in connection with a GSM network or any othermobile telephone network and may also be configured to meet the wirelessapplication protocol specification (WAP). Any type of wireless or othercommunications link may be utilized for the present invention. Forexample, the wireless communication network over which mobile devices102 may utilize a cellular-based communication infrastructure thatinclude cellular-based communication protocols such as AMPS, CDMA, TDMA,GSM, iDEN, GPRS, EDGE, UMTS, WCDMA and their variants.

The mobile device 102 a is powered by a removable battery pack 15.Signal processing is carried out under the control of a digitalmicro-controller 16 which has an associated RAM/ROM and flash memory 18.Electric analog signals are produced by microphone 7 and are fed to theearpiece 6. The controller 16 receives instruction signals from thekeypad 4 including the soft keys 10, 11, 12, 13, 14 and controls theoperation of the display 5. Radio signals are transmitted and receivedby means of an antenna 23 connected through a radio interface 24 to acodec 25 configured to process signals under control of the controller16. Thus, in use, for speech, the codec 25 receives analog signals fromthe microphone 7, digitizes them into a form suitable for transmissionand feeds them to the radio interface 24 for transmission throughantenna element 23 to the public land mobile network (PLMN). Similarly,received signals are fed to codec 25 so as to produce analog signalswhich are fed to the ear piece 6. The mobile device 102 a also includesa subscriber identification module (SIM) card 26, a SIM card reader 27,light emitting diodes (LEDs) 28 and a ringer 29. Mobile device 102 a mayalso be a dual mode phone having a wireless local area network (WLAN)interface, as well as other wireless or physical interfaces (such asBlueTooth® and USB).

FIG. 8 provides an overview of a mobile device client architectureaccording to one possible implementation of the invention. As the Figureillustrates, the physical instance of the mobile device 102 a may beconfigured to include one or more software modules that facilitateinteraction with device management server 104.

IPSec Client

IPSEC client provides secure connection functionality between the mobiledevice 102 a and device management server 104. The IPSec client, in oneimplementation, is able to tolerate IP address changes as the clientroams from one network to another.

Extended DM/DS Client

In most of the recent implementations DM/DS clients based on OMA specare included in mobile devices 102 a to provide device management anddata synchronization functionality. These agents respond to the commandsissued by the DM/DS server. There are some open source implementationsof DM/DS server and one of those implementations is Funambol. Though theDS spec doesn't specify what needs to be synchronized, most of theimplementations on the mobile devices are limited to synchronizing onlyPIM, contact info and some basic stuff. For synchronizing all data ofthe mobile client, the DM/DS client is extended.

FOTA Client

Firmware over the air is becoming very popular and most of the systemintegrators are including the clients that comply to OMA specificationin their firmware. There are some extensions to the client in someimplementations to deal with specialized synchronization mechanisms.

I/O Capture Driver

For accessing the mobile device remotely, an I/O capture driver can beinstalled to capture the I/O traffic and redirect that I/O through thenetwork to mobile device management server 104 so that remote users cancontrol the mobile device. This requires plugging in the I/O driverbetween the real hardware driver and the operating system.

Application Patch Management

Application patches are also delivered through the air similar to thefirmware. Sometimes the firmware upgrade includes the whole imageincluding the applications or only parts of the image. In some casesonly the software needs to be patched on top of the operating system. Insuch a case, an application patch manager can reside on top theoperating system and handle updates to the applications.

The present invention has been explained with reference to specificembodiments. Other embodiments will be evident to those of ordinaryskill in the art. It is therefore not intended that the presentinvention be limited to the embodiments described above.

1. A mobile device management system, comprising: at least one virtual instance mobile device, wherein each virtual instance mobile device corresponds to a unique one of at least one physical mobile device, wherein each of the at least one physical mobile devices comprises one or more hardware components, an operating system and one or more applications, wherein each virtual instance mobile device comprises an operating system and one or more applications corresponding to the operating system and the one or more applications of the corresponding unique one of the at least one physical mobile device, a hardware emulation component configured to emulate hardware components of the corresponding physical mobile device, and a software emulation component corresponding to software components of the corresponding physical mobile device and is executable within the context of the hardware emulation component; and wherein the operating system and the one or more applications of the virtual mobile instance are executable in a computer runtime environment that includes a hardware emulation component operative to emulate the one or more hardware components of the physical mobile device; a synchronization component configured to synchronize data between the at least one virtual instance mobile device with the corresponding at least one physical mobile device respectively; a data store configured to store data obtained from the at least one physical mobile device; and a management component configured to remotely manage the at least one physical mobile device by loading the corresponding at least one virtual instance mobile device into the computer runtime environment for execution, and cause the at least one virtual instance mobile device to be executed in the computer runtime environment in order to remotely manage the corresponding at least one physical mobile device respectively by loading and executing the hardware emulation component of the virtual instance mobile device and then executing the software emulation component of the virtual instance mobile device within the context of the hardware emulation component.
 2. A mobile device management system as recited in claim 1, wherein for each of the at least one virtual instance mobile device, the hardware emulation component comprises a processor emulator configured to emulate a processor of the corresponding physical mobile device; a memory emulator configured to emulate a memory of the corresponding physical mobile device; and a network interface emulator configured to emulate at least one network interface of the corresponding physical mobile device, and the software emulation component comprises the operating system corresponding to the operating system of the corresponding physical mobile device; at least one device driver corresponding to at least one device driver of the corresponding physical mobile device respectively; and the one or more applications corresponding to the one or more applications of the corresponding physical mobile device respectively.
 3. A mobile device management system as recited in claim 2, wherein for each of the at least one virtual instance mobile device, the hardware emulation component further comprises: an input/output (I/O) emulator configured to emulate at least one I/O component of the corresponding physical mobile device; and a display emulator configured to emulate a display of the corresponding physical mobile device.
 4. A mobile device management system as recited in claim 2, further comprising: a virtual mobile device platform configured to support the execution of the at least one virtual instance mobile device.
 5. A mobile device management system as recited in claim 1, further comprising: at least one user portal, wherein each user portal corresponds to a unique one of the at least one physical mobile device and is configured to enable a user to remotely access and control the corresponding physical mobile device.
 6. A method of remotely managing a mobile device, comprising: maintaining at least one virtual instance mobile device, wherein each virtual instance mobile device corresponds to a unique one of at least one physical mobile device, wherein each of the at least one physical mobile devices comprises one or more hardware components, an operating system and one or more applications, wherein each virtual instance mobile device comprises an operating system and one or more applications corresponding to the operating system and the one or more applications of the corresponding unique one of the at least one physical mobile device, a hardware emulation component configured to emulate hardware components of the corresponding physical mobile device, and a software emulation component corresponding to software components of the corresponding physical mobile device and is executable within the context of the hardware emulation component; and wherein the operating system and the one or more applications of the virtual mobile instance are executable in a computer runtime environment that includes a hardware emulation component operative to emulate the one or more hardware components of the physical mobile device; synchronizing data between the at least one virtual instance mobile device with the corresponding at least one physical mobile device respectively; storing data obtained from the at least one physical mobile device; and remotely managing the at least one physical mobile device by loading the corresponding at least one virtual instance mobile device into the computer runtime environment for execution, and executing the at least one virtual instance mobile device in the computer runtime environment to emulate behavior of the corresponding at least one physical mobile device respectively by executing the hardware emulation component of the virtual instance mobile device and executing the software emulation component of the virtual instance mobile device within the context of the hardware emulation component.
 7. A method as recited in claim 6, wherein for each of the at least one virtual instance mobile device, the hardware emulation component comprises a processor emulator configured to emulate a processor of the corresponding physical mobile device; a memory emulator configured to emulate a memory of the corresponding physical mobile device; and a network interface emulator configured to emulate at least one network interface of the corresponding physical mobile device, and the software emulation component comprises the operating system corresponding to the operating system of the corresponding physical mobile device; at least one device driver corresponding to at least one device driver of the corresponding physical mobile device respectively; and the one or more applications corresponding to the one or more applications of the corresponding physical mobile device respectively.
 8. A method as recited in claim 7, wherein for each of the at least one virtual instance mobile device, the hardware emulation component further comprises: an input/output (I/O) emulator configured to emulate at least one I/O component of the corresponding physical mobile device; and a display emulator configured to emulate a display of the corresponding physical mobile device.
 9. A method as recited in claim 1, further comprising: maintaining at least one user portal, wherein each user portal corresponds to a unique one of the at least one physical mobile device and is configured to enable a user to remotely access and control the corresponding physical mobile device.
 10. An apparatus for remotely managing a mobile device, wherein the mobile device comprises one or more hardware components, an operating system and one or more applications, the apparatus comprising: a processor; a memory; at least one network interface; a device emulation component corresponding to the mobile device, comprising a hardware emulation component configured to emulate the one or more hardware components of the mobile device; and a software emulation component corresponding to software components of the mobile device wherein the software emulation component comprises an operating system and one or more applications corresponding to the operating system and the one or more applications of the mobile device, and wherein the operating system and the one or more applications of the software emulation compontent are executable within the context of the hardware emulation component; and a virtual mobile device platform, within which a device emulation component is executed to emulate behavior of the mobile device, the device management component configured to remotely manage the mobile device, comprising computer-readable medium having a plurality of computer program instructions stored therein, which are operable to cause the processor to maintain and execute the device emulation component in a computer runtime environment, synchronize the device emulation component with the corresponding mobile device, store data obtained from the mobile device in the memory, remotely manage the mobile device by emulating the mobile device in the computer runtime environment using the device emulation component, execute the hardware emulation component in the computer runtime environment, and execute the software emulation component within the context of the hardware emulation component.
 11. An apparatus as recited in claim 10, wherein the device emulation component for the mobile device represents a virtual instance mobile device.
 12. An apparatus as recited in claim 10, wherein the hardware emulation component comprises: a processor emulator configured to emulate a processor of the mobile device; a memory emulator configured to emulate a memory of the mobile device; and a network interface emulator configured to emulate at least one network interface of the mobile device, and the software emulation component comprises: the operating system corresponding to the operating system of the mobile device; at least one device driver corresponding to at least one device driver of the corresponding mobile device respectively; and the one or more applications corresponding to the one or more applications of the corresponding mobile device respectively.
 13. An apparatus as recited in claim 10, further comprising: a user portal corresponding to the mobile device, wherein the plurality of computer program instructions are further operable to cause the processor to maintain the user portal and enable a user to remotely access and control the mobile device. 